diff --git a/CHANGELOG.md b/CHANGELOG.md
index 38da73e1ca3de0492bd61790e5e561ed8724bb3e..12d76fcf5648276f003fd110f17beb03b042c2c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [3.3.2](https://gitlab.com/to-be-continuous/helmfile/compare/3.3.1...3.3.2) (2025-04-11)
+
+
+### Bug Fixes
+
+* **envsubst:** leave lines with '# nosubst' unchanged when substituting (used to be simply dropped) ([097865e](https://gitlab.com/to-be-continuous/helmfile/commit/097865e55e36d269d35da0139d2d63f276ad087d))
+
 ## [3.3.1](https://gitlab.com/to-be-continuous/helmfile/compare/3.3.0...3.3.1) (2025-02-01)
 
 
diff --git a/README.md b/README.md
index 7b6e9491843487e8f879972e5993d2abeafa7d2b..9168db8b2bb23fbded039afab127b0892e153e94 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ Add the following to your `.gitlab-ci.yml`:
 ```yaml
 include:
   # 1: include the component
-  - component: $CI_SERVER_FQDN/to-be-continuous/helmfile/gitlab-ci-helmfile@3.3.1
+  - component: $CI_SERVER_FQDN/to-be-continuous/helmfile/gitlab-ci-helmfile@3.3.2
     # 2: set/override component inputs
     inputs:
       # ⚠ this is only an example
@@ -33,7 +33,7 @@ Add the following to your `.gitlab-ci.yml`:
 include:
   # 1: include the template
   - project: 'to-be-continuous/helmfile'
-    ref: '3.3.1'
+    ref: '3.3.2'
     file: '/templates/gitlab-ci-helmfile.yml'
 
 variables:
@@ -425,9 +425,9 @@ With:
 ```yaml
 include:
   # main template
-  - component: $CI_SERVER_FQDN/to-be-continuous/helmfile/gitlab-ci-helmfile@3.3.1
+  - component: $CI_SERVER_FQDN/to-be-continuous/helmfile/gitlab-ci-helmfile@3.3.2
   # Vault variant
-  - component: $CI_SERVER_FQDN/to-be-continuous/helmfile/gitlab-ci-helmfile-vault@3.3.1
+  - component: $CI_SERVER_FQDN/to-be-continuous/helmfile/gitlab-ci-helmfile-vault@3.3.2
     inputs:
       # audience claim for JWT
       vault-oidc-aud: "https://vault.acme.host"
diff --git a/templates/gitlab-ci-helmfile-vault.yml b/templates/gitlab-ci-helmfile-vault.yml
index e6bb722a69278810d205f9a4c9e13e34a2de70b8..36f32fe666e57876f31ed68a86f49cfb23a13b05 100644
--- a/templates/gitlab-ci-helmfile-vault.yml
+++ b/templates/gitlab-ci-helmfile-vault.yml
@@ -23,7 +23,7 @@ variables:
 .helmfile-base:
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "helmfile", "3.3.1"]
+      command: ["--service", "helmfile", "3.3.2"]
     - name: "$TBC_VAULT_IMAGE"
       alias: "vault-secrets-provider"
   variables:
diff --git a/templates/gitlab-ci-helmfile.yml b/templates/gitlab-ci-helmfile.yml
index 6acb8f06183008a1ca2830908f89f89c32af1944..48f2e39dd57854a56847e049afeb7c87c9dd2103 100644
--- a/templates/gitlab-ci-helmfile.yml
+++ b/templates/gitlab-ci-helmfile.yml
@@ -729,7 +729,7 @@ stages:
     entrypoint: [""]
   services:
     - name: "$TBC_TRACKING_IMAGE"
-      command: ["--service", "helmfile", "3.3.1"]
+      command: ["--service", "helmfile", "3.3.2"]
   variables:
     HELM_CACHE_HOME: $CI_PROJECT_DIR/.cache/helm
     HELM_CONFIG_HOME: $CI_PROJECT_DIR/.config/helm